Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.1
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.1
Description:Add nftables notrack for localhost traffic
- Removed. License is now included in the main project.
net/https-dns-proxy/Makefile:
- Bumped PKG_RELEASE to 5.
net/https-dns-proxy/files/etc/config/https-dns-proxy:
- Added 'option notrack_dns '1'' to the default configuration.
net/https-dns-proxy/files/etc/init.d/https-dns-proxy:
- Defined NOTRACK_NFT_FILE constant.
- Added 'notrack_dns' and 'notrack_ports' variables.
- Implemented 'notrack_nft' function to manage nftables rules for notracking local DNS traffic.
- Enabled loading of 'notrack_dns' boolean from configuration.
- Modified start_instance to collect listen_port into notrack_ports if notrack_dns is enabled.
- Modified start_service to call notrack_nft update/remove based on notrack_dns and collected ports.
- Modified stop_service to call notrack_nft remove.
- Updated service_started and service_stopped to trigger firewall config changes when notrack_dns is enabled.
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit fa4b35ad53)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
* Switch Hagezi URL to a more compact higher-level only domains list as we
prefer it anyways and there's less processing (thanks @dave14305)
* When update_config_sizes is unset, save collected sizes to RAM to improve
luci app performance (thanks @sshaikh)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 5e0b94f2a4)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
handle dalias/calias config currectly by dns challenge hook so it won't
break uacme when given
Signed-off-by: Seo Suchan <tjtncks@gmail.com>
(cherry picked from commit d824c1fc90)
migrate old uacme specific config parameters into acme-common format.
Signed-off-by: Seo Suchan <tjtncks@gmail.com>
(cherry picked from commit 2da557bbf5)
remake uacme hook scripts to base on acme-common,
and implements helper to able to use acme.sh DNS APIs
Signed-off-by: Seo Suchan <tjtncks@gmail.com>
(cherry picked from commit 7f88cc5eb8)
currently acme metapackage only able to satisfied with acme-acmesh,
but make is satisfieable by uacme if it's already installed.
still defaults to acme.sh
Signed-off-by: Seo Suchan <tjtncks@gmail.com>
(cherry picked from commit fe3d05090b)
The new DCO module depends on OpenVPN 2.7.1.
For details refer to https://github.com/OpenVPN/openvpn/blob/v2.7.1/Changes.rst
Removed upstreamed wolfSSL patches:
- 101-Fix-EVP_PKEY_CTX_-compilation-with-wolfSSL.patch
- 102-Disable-external-ec-key-support-when-building-with-wolfSSL.patch
Reworked 100-mbedtls-disable-runtime-version-check.patch to use
MBEDTLS_VERSION_STRING instead of a mutable buffer.
Signed-off-by: Qingfang Deng <dqfext@gmail.com>
(cherry picked from commit 9faf26770b)
Signed-off-by: Sander van Deijck <sander@vandeijck.com>
fix: avoid unnecessary dnsmasq restarts (thanks @egc112)
fix: insert, not add dns policies to ensure higher priority than the DNS
hijack rules (thanks @egc112)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
(cherry picked from commit 727ca8a3a5)
Signed-off-by: Stan Grishin <stangri@melmac.ca>
* flock/serialize the etag writing in the f_etag function
* added various variables to local scope
* LuCI: removed needless ACL
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 01c7cf719e)
Bump version for quickly discovered issues with 3.7.0
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit 0de3688f10)
* added an separate adblock rundir (/var/run/adblock)
* refine the cpu/core detection
* behaviour change: allowlist domains now also removes subdomains from the blocklist
* flock/serialize the etag writing in the f_etag function
* code clean-up/linting
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 157bd82ac0)
* fixed the initialization of the banIP rundir (reported in the forum)
* sanitize possible windows line endings in local block- and allowlist
* refine the cpu/core detection
* code clean-up/linting
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 420d966267)
Bump version and add placeholder for new [sharing]
section/capability.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit f534f48ab8)
* fixed two issues in the mail template, reported in the forum
* tweak the f_report function
* changed the f_actual function to reduce subshell calls
* further optimize the monitor function:
* fixed a possible RDAP rate-limit race condition,
serialize the rdap_tsfile via flock
* block_cache bounded growth, when the cache reaches 500
entries it resets to empty, preventing unbounded string growth
in the monitor loop
* set the printf format string in single quotes (overall)
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 79f2db6cc5)
* fixed a problem/regression with the display of results in f_search and f_report
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0255308cbe)
* refine the DNS reporting filter (stricter),
to filter out false positives
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 4af33e05a9)
* fixed a parsing issue in the DNS reporting,
see https://github.com/openwrt/packages/pull/29063 for details
* optimized the CGI/Adblock Remote Allow
* optimized the TLD function
* optimized the mail include
* removed needless forks
* various code-cleanups & small fixes
* updated the readme
* LuCI: small fixes & optimizations
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 5116abcafa)
* removed needless fork/exec calls (#29010)
* removed needless eval calls
* added parallel country and ASN feed downloads (#29010)
* rework the IP monitor:
* IP extraction, counting, and threshold detection now run
entirely inside a single gawk process
* added a dynamic cache management and a three-tier IP deduplication
* added asynchronous/non-blocking RDAP requests
* hardend the cgi script and mail template
* fixed#28998
* LuCI: added more status information
* LuCI: more fixes & optimizations (e.g. #8486)
* readme update
Co-authored-by: Colin Brown <devs@coralesoft.nz>
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 9c3470ac4a)
Add a new netcup DDNS provider using the netcup DNS api
(ccp.netcup.net) with API key authentication.
Configuration mapping:
* username = netcup customer number
* password = netcup API password
* param_enc = netcup API key (generated in the CCP)
* domain = fully qualified subdomain to update (e.g. home.example.de)
* param_opt = (optional) root/zone domain override (e.g. example.de)
When omitted the root domain is derived by stripping the
leftmost label from 'domain'. This only works correctly for
a single subdomain level (e.g. "home.example.de").
param_opt MUST be set explicitly in two cases:
1. Deep subdomains: domain=test.internal.example.org
2. ccSLD apex domains: domain=example.co.nz
Signed-off-by: Tim Flubshi <flubshi@gmail.com>
(cherry picked from commit 10b8f04e3e)
The 'ddns-scripts' packages still uses not the procd service handling.
This commit changes this.
This change also resolves the issue where, if a UCI configuration is
already present, the process is blocked during installation via APK and
does not complete.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Tested-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
(cherry picked from commit b1502c453e)
records
Problem:
When using Cloudflare with proxy enabled (orange cloud), DNS lookups
return Cloudflare's edge IP instead of the actual origin IP registered
in the dashboard. This causes ddns-scripts to incorrectly detect IP
mismatches, triggering unnecessary updates and potential rate limiting.
Solution:
Add an optional 'use_api_check' configuration option that enables
provider scripts to fetch the registered IP directly via their API,
bypassing DNS lookups.
Changes:
- dynamic_dns_functions.sh: Add API check block to get_registered_ip()
(~25 lines). When use_api_check is enabled, sources the provider
script with GET_REGISTERED_IP=1 flag. Falls back to DNS lookup if
API check is disabled, unsupported, or fails.
- update_cloudflare_com_v4.sh: Add handler for GET_REGISTERED_IP mode
(~15 lines). Reuses existing cURL setup and authentication to query
Cloudflare API for actual record content.
- etc/config/ddns: Document use_api_check option
Behavior:
- use_api_check=0 or unset: DNS lookup (existing behavior, no changes)
- use_api_check=1 with API support: API query for registered IP
- use_api_check=1 without API support: Falls back to DNS lookup
- API failure: Gracefully falls back to DNS lookup
Testing:
- Cloudflare (proxied): Correctly retrieves origin IP via API
- Cloudflare (non-proxied): Works correctly
- No-IP: DNS lookup works (no regression)
- IPv4 and IPv6 records tested
- API failure gracefully falls back to DNS
Signed-off-by: Wayne King 244781262+bdk38@users.noreply.github.com
Rui Salvaterra
Dirk Brenken
Stan Grishin
Seo Suchan
Qingfang Deng
George Sapkin
Daniel F. Dickinson
Olivier Poitrey
Maxim Storchak
Michał Kępień
John Audia
Daniel Golle
Tim Flubshi
Florian Eckert
Patrick Hemmen
bdk38
Lin Fan
Tianling Shen